Dridex

Dridex first appeared in 2012 as an evolution of the earlier Cridex and Bugat banking trojans. It incorporated elements of its predecessors’ code but introduced a peer-to-peer (P2P) communication architecture to enhance concealment and redundancy.{{Cite web |date=30 June 2020 |title=Dridex Malware |url=https://www.cisa.gov/news-events/cybersecurity-advisories/aa19-339a |access-date=22 April 2025 |website=U.S. Cybersecurity and Infrastructure Security Agency (CISA)}}

By 2015, it had become one of the most prevalent financial malware strains, particularly targeting banking credentials through email-based phishing campaigns and malicious macro-laden attachments. That year, theft attributed to Dridex was estimated at £20 million in the United Kingdom and $10 million in the United States, with attacks reported in more than 20 countries. In early September 2016, researchers observed the malware beginning to target cryptocurrency wallets.{{Cite web

| url=http://news.softpedia.com/news/dridex-banking-trojan-will-soon-target-crypto-currency-wallets-508041.shtml

| title=Dridex Banking Trojan Will Soon Target Crypto-Currency Wallets

| author=Catalin Cimpanu

| date=2016-09-07

| website=Softpedia

| access-date=2017-01-11}}

In 2017, Dridex was distributed through a widespread phishing campaign that exploited a Microsoft Word zero-day vulnerability. This method allowed infection without requiring users to enable macros and affected millions of users globally.{{Cite web |date=11 April 2017 |title=Microsoft Word 0-day used to push dangerous Dridex malware on millions |url=https://arstechnica.com/information-technology/2017/04/microsoft-word-0day-used-to-push-dangerous-dridex-malware-on-millions/ |access-date=20 April 2025 |website=Ars Technica}} Around the same time, newer versions of Dridex began exploiting a vulnerability in Microsoft Office and WordPad that allowed remote code execution.

In December 2019, US authorities filed charges against two suspects believed to have created the Dridex malware, including the group's alleged leader.{{Cite web|url=https://www.zdnet.com/article/us-charges-two-members-of-the-dridex-malware-gang/|title=US charges two members of the Dridex malware gang|last=Cimpanu|first=Catalin|date=December 5, 2019|website=ZDNet|access-date=December 8, 2019}}

In 2022, IBM researchers found similarities between the Raspberry Robin worm and Dridex malware loaders. Their comparative analysis showed that both used similar string decoding algorithms, anti-analysis techniques, and payload decryption routines. IBM suggested that Evil Corp may be using Raspberry Robin infrastructure to carry out attacks.{{Cite web |date=1 September 2022 |title=Raspberry Robin and Dridex: Two birds of a feather |url=https://www.ibm.com/think/x-force/raspberry-robin-worm-dridex-malware |access-date=20 April 2025 |website=IBM}}

Evil Corp (also known as Dridex and INDRIK SPIDER), the group behind the Dridex malware, is a Russian hacking group that has been active since 2009.{{Cite web|last=Mujezinovic|first=Damir|date=2021-09-10|title=Evil Corp: A Deep Dive Into One of the World's Most Notorious Hacker Groups|url=https://www.makeuseof.com/a-look-at-evil-corp/|url-status=live|access-date=2021-11-23|website=MakeUseOf|language=en-US|archive-url=https://web.archive.org/web/20210910132807/https://www.makeuseof.com/a-look-at-evil-corp/ |archive-date=2021-09-10 }} Evil Corp operated with a hierarchical structure similar to traditional organized crime groups rather than typical cybercriminal networks. Its leader, Maksim Yakubets, ran the operation out of Moscow with the involvement of family members, including his father, brother, and cousins. The group invested heavily in laundering operations and maintained a tight-knit internal culture, regularly socializing and vacationing together.

In 2019, the Federal Bureau of Investigation (FBI) named nine alleged members of the group, accusing them of extorting or stealing over $100,000,000 through hacks that affected 40 countries.{{Cite news|last=Tidy|first=Joe|date=2021-11-17|title=Evil Corp: 'My hunt for the world's most wanted hackers'|language=en-GB|work=BBC News|url=https://www.bbc.com/news/technology-59297187|access-date=2021-11-23}} That same year, the United States Department of the Treasury imposed sanctions on the group,{{Cite web|date=December 5, 2019|title=Treasury Sanctions Evil Corp, the Russia-Based Cybercriminal Group Behind Dridex Malware|url=https://home.treasury.gov/news/press-releases/sm845|url-status=live|access-date=2021-11-23|website=U.S. Department of the Treasury|language=en|archive-url=https://web.archive.org/web/20191205162245/https://home.treasury.gov/news/press-releases/sm845 |archive-date=2019-12-05 }} and the Office of Foreign Assets Control (OFAC) banned individuals in the U.S. from engaging in transactions with them. People outside the US may be subject to secondary sanctions for facilitating significant transactions with the group. The US government also charged two members and offered a $5 million reward for information leading to their arrest.

As a result of the 2019 US and UK sanctions, Evil Corp was forced to alter its tactics. Facing increased scrutiny and legal risk, members abandoned online accounts, restricted their movements, and ceased using Dridex malware. The group adopted alternative access tools like SocGholish and began deploying a rotating set of ransomware strains, including WastedLocker and Hades, to conceal their identity and continue operations.

In November 2021, the BBC reported that two alleged leaders of Evil Corp were living openly in Russia.{{Cite news|last=White|first=Debbie|date=November 17, 2021|title=Hackers accused of stealing $100m live openly in Russia|language=en|work=The Times|url=https://www.thetimes.com/culture/tv-radio/article/evil-corp-hackers-accused-of-stealing-100m-live-openly-in-russia-fcxw7qcnk|access-date=2021-11-23|issn=0140-0460}} The following month, analysts at Emsisoft suggested that a ransomware attack initially attributed to REvil may have been the work of Evil Corp.

In June of 2022, cybersecurity firm Mandiant reported that Evil Corp had begun using off-the-shelf ransomware, such as LockBit, to disguise its identity and evade sanctions.{{Cite news |title=Even Russia's Evil Corp now favors software-as-a-service |url=https://www.theregister.com/2022/06/03/evil-corp-ransomware-sanctions/ |last=Burt |first=Jeff |date=2022-06-03 |access-date=2022-06-04 |work=The Register}} Mandiant also linked the group to threat actor UNC2165.

Between 2022 and 2024, Evil Corp diversified its tactics and began affiliating with other ransomware groups, including LockBit. The group continued its use of SocGholish as its primary initial access tool. The UK’s National Crime Agency (NCA) identified Aleksandr Ryzhenkov, a senior figure in Evil Corp, as a LockBit affiliate involved in ransomware attacks. In February 2024, LockBit was disrupted by an international law enforcement operation led by the NCA, known as Operation Cronos. Some Evil Corp members remain active in Russia; in December 2022, Igor Turashev and his company placed third in a hackathon organized by the Wagner Group.{{Cite web |date=October 2024 |title=Evil Corp: Behind the Screens |url=https://www.nationalcrimeagency.gov.uk/who-we-are/publications/732-evil-corp-behind-the-screens/file |access-date=21 April 2025 |website=U.K. National Crime Agency (NCA)}}

==See also==

• Botnet
• Conficker
• Gameover ZeuS
• Operation Tovar
• Timeline of computer viruses and worms
• Tiny Banker Trojan
• Torpig
• Zeus (malware)
• Zombie (computer science)

{{Reflist|30em}}

{{authority control}}{{Hacking in the 2020s}}

{{Hacking in the 2010s}}

Category:2015 in computing

Category:Windows trojans

Category:Cyberattacks on banking industry

Category:Hacking in the 2020s

Category:2009 establishments in Russia

Category:Russian entities subject to U.S. Department of the Treasury sanctions

Category:Extortionists

Category:Ransomware